CVE-2019-10292

CVE-2019-10292 describes a cross-site request forgery in the Jenkins Kmap Plugin, specifically in the KmapJenkinsBuilder.DescriptorImpl form validation methods. The vulnerability allows an unauthenticated or insufficiently authenticated attacker to trigger requests that cause the Jenkins server t...

CVE-2019-10294

CVE-2019-10294 concerns the Jenkins Kmap Plugin, where credentials are stored unencrypted in job config.xml files on the Jenkins master. The underlying issue enables exposure to users with Extended Read permission or with access to the master filesystem. The initial entry and multiple connected a...

CVE-2019-10293

CVE-2019-10293 affects the Jenkins Kmap Plugin. The vulnerability is a missing permission check in KmapJenkinsBuilder.DescriptorImpl form validation that allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server (SSRF-like behavior). Affected product/c...